The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Clerk JWT Claims in Laravel: The SDK-Less Way That Actually Works
Clerk's frontend SDKs are slick, but the backend story for Laravel is 'bring your own.' Here's exactly how I wired it without surprises.
Clerk has no official Laravel SDK. That's not a complaint — it's just a fact you should know before you commit to it on a PHP project. What Clerk does have is a well-documented JWT-based session model, a public JWKS endpoint, and enough rope to hang yourself if you skip a few steps. I learned most of what's below by…
Read the daily →MariaDB Full-Text Search Is Probably Enough (I Know, I Know)
Before you spin up another service, try MATCH...AGAINST. I've been surprised more than once by how far native MariaDB full-text gets you.
Every time search comes up on a project, there's an immediate gravitational pull toward adding a dedicated search service. Meilisearch, Algolia, Elasticsearch — pick your poison. I've done it too. But the last three times I've actually stopped, benchmarked, and thought it through, MariaDB's native full-text search was…
Read the daily →PHP-FPM pm.max_children: The Math Nobody Writes Down
Everyone cargo-cults 50 workers. Here's how I actually calculate pm.max_children for a Laravel app on a single VM, and why getting it wrong kills you quietly.
Every few months I inherit a server someone else configured, and is either 10 (starving) or 500 (thrashing). Nobody got fired for either number because the app "works" — until traffic spikes or a slow query holds workers and the whole thing falls over. Here's the math I actually use, and why the defaults are quietly…
Read the daily →Redis Does Three Jobs on One Server and I've Never Replaced It
Five years of using Redis as queue, cache, and session store on a single box. Here's why I haven't touched it.
I keep waiting to find a reason to replace Redis with something more interesting. Five years in, across a dozen production deployments, I haven't found one. That's not a ringing endorsement — it's more like the quiet satisfaction of a tool that just refuses to cause problems. What Redis Actually Solves For Me The…
Read the daily →Rate limiting at nginx before Laravel ever wakes up
Blocking brute-force attempts at the nginx layer is cheaper and faster than doing it in PHP. Here's the actual config I use for login and API endpoints.
Most Laravel apps I inherit have rate limiting wired up in the application layer — a middleware, a facade call in , maybe a package. That's fine as far as it goes, but it means every blocked request still boots PHP-FPM, hits the framework, hydrates the service container, and burns a worker slot. For a login endpoint…
Read the daily →